diff --git a/.github/workflows/update-submodules.yml b/.github/workflows/update-submodules.yml
new file mode 100644
index 000000000..607a75bc1
--- /dev/null
+++ b/.github/workflows/update-submodules.yml
@@ -0,0 +1,27 @@
+name: Update submodules
+
+on:
+  schedule:
+  - cron: '0 7 * * *'
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: DFHack branch to update
+        required: false
+        default: develop
+
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Clone DFHack
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.inputs.branch }}
+        submodules: true
+    - name: Update submodules
+      run: |
+        if bash -x ci/update-submodules.bash; then
+          git push
+        fi
diff --git a/ci/update-submodules.bash b/ci/update-submodules.bash
new file mode 100755
index 000000000..95727e42a
--- /dev/null
+++ b/ci/update-submodules.bash
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -e
+
+message_file=.git/COMMIT_EDITMSG
+
+get_git_root() {
+    git rev-parse --show-toplevel
+}
+
+write_msg() {
+    echo "$@" >> "${message_file}"
+}
+
+git_root="$(get_git_root)"
+cd "${git_root}"
+rm -f "${message_file}"
+write_msg "Auto-update submodules"
+write_msg ""
+
+cat ci/update-submodules.manifest | while read path branch; do
+    cd "${git_root}/${path}"
+    test "${git_root}" != "$(get_git_root)"
+    git checkout "${branch}"
+    git pull
+    cd "${git_root}"
+    if ! git diff --quiet --ignore-submodules=dirty -- "${path}"; then
+        git add "${path}"
+        write_msg "${path}: ${branch}"
+    fi
+done
+
+if ! git diff --exit-code --cached; then
+    git commit --file "${message_file}" --no-edit
+    exit 0
+else
+    exit 1
+fi
diff --git a/ci/update-submodules.manifest b/ci/update-submodules.manifest
new file mode 100644
index 000000000..6e2a3ffc1
--- /dev/null
+++ b/ci/update-submodules.manifest
@@ -0,0 +1,6 @@
+library/xml master
+scripts master
+plugins/stonesense master
+depends/libzip dfhack
+depends/libexpat dfhack
+depends/xlsxio dfhack